blob: 922035700e2783ea8c48e4e5730e459c2752279a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.programs.wireshark;
wireshark = cfg.package;
in
{
options = {
programs.wireshark = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to add Wireshark to the global environment and create a 'wireshark'
group. To configure what users can capture, set the `dumpcap.enable` and
`usbmon.enable` options. By default, users in the 'wireshark' group are
allowed to capture network traffic but not USB traffic.
'';
};
package = lib.mkPackageOption pkgs "wireshark-cli" {
example = "wireshark";
};
dumpcap.enable = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether to allow users in the 'wireshark' group to capture network traffic. This
configures a setcap wrapper for 'dumpcap' for users in the 'wireshark' group.
'';
};
usbmon.enable = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Whether to allow users in the 'wireshark' group to capture USB traffic. This adds
udev rules to give users in the 'wireshark' group read permissions to all devices
in the usbmon subsystem.
'';
};
};
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ wireshark ];
users.groups.wireshark = { };
security.wrappers.dumpcap = lib.mkIf cfg.dumpcap.enable {
source = "${wireshark}/bin/dumpcap";
capabilities = "cap_net_raw,cap_net_admin+eip";
owner = "root";
group = "wireshark";
permissions = "u+rx,g+x";
};
services.udev.packages = lib.mkIf cfg.usbmon.enable [
(pkgs.writeTextDir "etc/udev/rules.d/85-wireshark-usbmon.rules" ''
SUBSYSTEM=="usbmon", MODE="0640", GROUP="wireshark"
'')
];
};
}
|
